Security audit

Voice Bridge Light

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate STT/TTS voice bridge, but it exposes a powerful unauthenticated audio service too broadly and recommends running it persistently as root.

Review carefully before installing. Use it only on localhost unless you add authentication and firewall controls, do not run it as root, avoid the recommended system-wide service as written, add upload/rate limits, and prefer pinned dependencies or a vetted lockfile. Treat any text sent through the default Edge TTS backend as leaving the local machine for Microsoft’s online TTS service.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: api_server.py:38
Finding: Unauthenticated API Exposed on All Network Interfaces
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:103
Finding: Root-Level Persistent systemd Service Exceeds Required Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: api_server.py:87
Finding: Unbounded Uploads and Inference Permit Remote Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: api_server.py:145
Finding: Uploaded Audio Files Remain on Disk When Processing Fails
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unbounded and Unverified Third-Party Dependencies
Content: View full analysis
=2.3.0 flask-cors>=4.0.0 numpy>=1.24.0 soundfile>=0.12.0 piper-tts>=1.2.0 faster-whisper>=0.10.0 edge-tts>=6.1.6 pydub>=0.25.0 pyyaml>=6.0.1 ``` ### Technical Analysis Every package uses only a minimum version constraint. As a result, separate installations can resolve to different future releases, including versions that have not been reviewed with this project. No lock file or package hashes verify the exact artifacts installed. This is particularly significant because several dependencies process complex media or include native components. The documented root service configuration further increases the consequences if an installed dependency is compromised or contains an exploitable vulnerability. The project uses recognizable package names and standard PyPI installation; the reviewed files do not establish dependency confusion, typosquatting, or an intentionally malicious package. The confirmed weakness is the lack of reproducibility, upper constraints, and artifact integrity controls. ### Attack Path 1. An administrator runs `pip install -r requirements.txt`. 2. The package resolver selects the newest versions satisfying the lower bounds at that time. 3. A future compromised, vulnerable, or incompatible release can be selected without a project change. 4. Python imports those packages when the API service starts. 5. If installation or import-time code is malicious, or runtime processing exposes a dependency vulnerability, it executes with the service account's privileges. 6. Under the documented service configuration, that account is `root`, increasing the possible system impact. ### Impact Assessment The exact impact depends on the affected dependency. A compromised package could execute code during installation or import ...[truncated 284 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documentation is written in Chinese from the opening description onward, with no indication that other languages are supported or that the Chinese-only presentation is intentional for a region-specific use case. This creates a natural-language policy concern because the skill effectively imposes a specific language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README sets EDGE_VOICE to zh-CN-XiaoxiaoNeural and the Piper default model to zh_CN-huayan-medium.onnx, which imposes a Chinese locale by default. The document does not offer an explicit user opt-in or explain that the skill is intentionally region/language-specific, so this appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 54)May include surrounding context.
TTS Request Example

bash
curl -X POST http://localhost:18790/audio/speech \ -H "Content-Type: application/json" \ -d '{ "input": "Hello, world!",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
TTS Request Example

bash
curl -X POST http://localhost:18790/audio/speech \ -H "Content-Type: application/json" \ -d '{ "input": "Hello, world!",

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 120)May include surrounding context.
Enable and start:

bash
systemctl daemon-reload systemctl enable voice-bridge-light.service systemctl start voice-bridge-light.service

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
Enable and start:

bash
systemctl daemon-reload systemctl enable voice-bridge-light.service systemctl start voice-bridge-light.service

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Edge TTS path sends user-supplied text to Microsoft's online TTS service via edge_tts, which exposes potentially sensitive prompt content to a third party. In a voice bridge service, users may reasonably expect local processing, so the lack of explicit disclosure/consent and no option to enforce local-only synthesis creates a real privacy risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The call to engine.transcribe hard-codes language="zh", which constrains recognition to a specific language. This is a natural-language policy concern because the skill does not offer users a language choice or explain why a Chinese-only restriction is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description is written entirely in Chinese and provides no indication that users can opt into another language or locale. Under the policy, language or locale constraints should either offer a choice or be clearly documented as justified for a region-specific tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The transcription handler reads the uploaded file and persists it to a temporary .wav file before processing. Although the file is later deleted, this is still a file-write operation affecting user data, and the code provides no user-facing notice, prompt, or descriptive comment explaining that uploaded audio is written to disk.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency uses a lower-bound constraint (flask>=2.3.0) instead of a pinned or tightly bounded version, which makes builds non-reproducible and can cause installation of unexpected vulnerable or breaking releases over time. In a skill environment, this increases supply-chain risk because the actual installed version cannot be reliably audited.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
flask>=2.3.0 flask-cors>=4.0.0 numpy>=1.24.0 soundfile>=0.12.0

Unverifiable Dependency: flask has 10 known advisory(ies) (CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Flask has known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether deployed environments are affected or not. This uncertainty materially weakens vulnerability management even though the file alone does not prove an exploitable Flask flaw is present.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency uses an unpinned minimum version (flask-cors>=4.0.0), so deployments may resolve to different versions with different security properties. This weakens reproducibility and makes it harder to ensure that vulnerable releases are not introduced.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
flask>=2.3.0 flask-cors>=4.0.0 numpy>=1.24.0 soundfile>=0.12.0 piper-tts>=1.2.0

Unverifiable Dependency: flask-cors has 12 known advisory(ies) (CVE-2024-6866 (Flask-CORS vulnerable to Improper Handling of Case Sensitivity); CVE-2024-6839 (Flask-CORS improper regex path matching vulnerability); CVE-2024-1681 (flask-cors vulnerable to log injection when the log level is set to debug) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Flask-CORS has multiple published advisories, but the unpinned requirement prevents verification of whether a safe release is installed. Given that CORS behavior affects browser trust boundaries, unresolved version ambiguity is a meaningful security weakness.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: Using numpy>=1.24.0 allows any newer version to be installed, which can introduce unreviewed security issues or incompatible behavior. Even for a common library, unpinned resolution increases supply-chain uncertainty and audit difficulty.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
flask>=2.3.0 flask-cors>=4.0.0 numpy>=1.24.0 soundfile>=0.12.0 piper-tts>=1.2.0 faster-whisper>=0.10.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: NumPy has known advisories, and the floating version constraint makes it impossible to confirm whether the runtime version is affected. While many NumPy issues are context-dependent, unverifiable dependency state still creates audit and supply-chain risk.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The soundfile package is not pinned to an exact version, so future installs may silently pull in a release with security or stability regressions. This is a dependency hygiene weakness that can become exploitable if a compromised or vulnerable version is resolved.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
flask>=2.3.0 flask-cors>=4.0.0 numpy>=1.24.0 soundfile>=0.12.0 piper-tts>=1.2.0 faster-whisper>=0.10.0 edge-tts>=6.1.6

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The piper-tts dependency is specified as a minimum version only, which permits uncontrolled upgrades during installation. That creates a supply-chain exposure and prevents reliable determination of what code will run in production.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
flask-cors>=4.0.0 numpy>=1.24.0 soundfile>=0.12.0 piper-tts>=1.2.0 faster-whisper>=0.10.0 edge-tts>=6.1.6 pydub>=0.25.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The faster-whisper dependency is unpinned, so installation results may vary across environments and over time. This can introduce vulnerable or malicious upstream changes without any manifest modification in the skill itself.
Content: Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.
text
numpy>=1.24.0 soundfile>=0.12.0 piper-tts>=1.2.0 faster-whisper>=0.10.0 edge-tts>=6.1.6 pydub>=0.25.0 pyyaml>=6.0.1

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The edge-tts package is allowed to float above a minimum version, which makes dependency resolution unpredictable and weakens supply-chain assurance. The risk is elevated by the inability to confirm which exact code will be installed.
Content: Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.
text
soundfile>=0.12.0 piper-tts>=1.2.0 faster-whisper>=0.10.0 edge-tts>=6.1.6 pydub>=0.25.0 pyyaml>=6.0.1

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The pydub dependency is not pinned, allowing future installations to resolve to arbitrary newer releases. This creates a low-severity but real supply-chain and reproducibility risk.
Content: Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.
text
piper-tts>=1.2.0 faster-whisper>=0.10.0 edge-tts>=6.1.6 pydub>=0.25.0 pyyaml>=6.0.1

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The pyyaml dependency is unpinned, which is especially concerning because YAML parsers have a history of security-sensitive issues. Without an exact version, the installed release cannot be confidently assessed for known vulnerabilities or safe parsing behavior.
Content: Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.
text
faster-whisper>=0.10.0 edge-tts>=6.1.6 pydub>=0.25.0 pyyaml>=6.0.1

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: PyYAML has a history of deserialization and input-validation vulnerabilities, and the manifest does not pin a version, so affected deployments cannot be ruled out. In a skill that may process configuration or user-provided YAML, this uncertainty is more dangerous because unsafe parser behavior can lead to serious compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

TTS Request Example

External Transmission

TTS Request Example

Session Persistence

Session Persistence

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Static analysis